mailing list archives
Re: Mouseover URL spoof with IE
From: Martin Stricker <shugal () gmx de>
Date: Wed, 09 Feb 2005 23:02:25 +0100
On Wed, 9 Feb 2005 12:24:29 -0800, Thor Larholm wrote:
The addressbar can by design be programmatically changed to display
anything you want at any time, including when you hover over a link
and the onmouseover event fires. Simply change the window.status
property from JS.
Based on my answer above, I take this as a definite "yes" by the
means of the web designer/developer simply changing the window.status
property in their java script?
If you point your mouse over that link, you'll see "http://nice-site.xx"
in the status bar, but clicking will lead you to http://bad-site.xx/.
This is already widely used in spoof e-mails.
[.xx is a ccTLD which, per RFC and ISO standard, will *never* be used,
so my example domains will never exist. Just a precaution.]
Linux Migration Project: http://www.linux-migration.org/
Red Hat Linux 9 for low memory: http://www.rule-project.org/
Registered Linux user #210635: http://counter.li.org/
Full-Disclosure - We believe in it.